Protecting your domain name

Module 4: Email, website and domain · Reading time: 11 minutes

Learning objective: After this lesson you can protect your domain name against expiry, hijacking and incorrect DNS records, and check the status, expiry, DNSSEC and CAA of your own domain.
Key concepts: registrar, registrant, expired, quarantine, transfer code, registrar lock, registry lock, 2FA at the registrar, DNSSEC, CAA, dangling record (dangling DNS), subdomain takeover

Whoever holds your domain holds your mail

Your domain name seems like a small thing: an annual invoice and a few settings. But almost everything depends on it. Your website, your email addresses, and with that also the "forgot password" button of all your other accounts: your accounting package, your bank, your webshop platform, your social media. Whoever gains control of example.com can receive mail for info@example.com and use it to reset your password anywhere.

A domain can be lost or misused in three ways:

1. it expires and someone else registers it;
2. someone hijacks it via your account at the registrar or via a forged transfer;
3. a forgotten DNS record points to something you no longer control.

In the DNS course (lesson 1.3) you learned who does what: the registry manages the extension (SIDN for .nl), the registrar registers on your behalf, and you are the registrant. In this lesson we look at that chain through the eyes of an attacker.

Is the registrant correct?

The registrant is the legal owner. If that shows your web builder, a former employee or a company that no longer exists, you'll find it hard to prove the domain is yours in a dispute or bankruptcy. So check:

• is your company registered as the registrant, with the correct name?
• is the registrant's email address reachable, and is it not on the domain itself? If example.com expires, the warning sent to info@example.com might not arrive. Use a second address, for example on a different domain.
• do you respond to genuine requests to confirm your address? For many extensions, ICANN requires the registrant's email address to be confirmed. If you don't, the domain can be suspended.

Expiry: the dullest and most common risk

Domains are most often lost through an expired credit card, an invoice that arrived with a colleague who has since left, or a switch where nobody thought about the domain. What happens next differs per extension:

After that, someone else can register it. There are parties who automatically register domains as they become available, precisely because there's still traffic on them. If the new owner sets up a catch-all on the mail, they receive everything your customers and suppliers still send to your old addresses, including password reset emails.

Protection:

• turn on automatic renewal and keep your payment details up to date;
• record all domains in a list, including the domains you keep "just in case";
• don't simply cancel an old domain you once used for mail. Keep it, and secure it as a non-mailing domain (lesson 4.1).

Hijacking: your registrar account and the transfer code

The quickest route to a domain runs through the account at your registrar. Whoever logs in there can change the nameservers and thereby redirect your website and mail in one go. So treat that account as one of your most important ones:

• turn on two-factor authentication (module 2);
• only people with their own account and the permissions they need (lesson 7.1). Your web builder preferably gets access to the DNS, not to the whole account;
• watch out for phishing about your domain. "Your domain expires today, pay here" or "confirm your details with ICANN" is a well known trick. Never follow the link, but log in to your registrar yourself.

A transfer code (also authorisation code, EPP code or token) is needed to move a domain to another registrar. Treat this code as a key: only request it when you're moving the domain yourself, only share it with the new registrar, and be alert immediately if you receive a transfer confirmation you weren't expecting.

There are also locks:

• A registrar lock sets the status clientTransferProhibited (often together with clientDeleteProhibited and clientUpdateProhibited). The registry then refuses a transfer until you or your registrar remove the lock. For .com and similar extensions this is common; ICANN recommends it.
• A registry lock goes further: changes are only applied at the registry itself after an extra, manual check with the registrant. For .nl this service is called .nl Control. It's mainly intended for large brands and costs extra; for most small businesses 2FA and a well managed registrar account are enough.

Dangling records and subdomain takeover

This is the least well known risk, and the most treacherous. A real-world example (anonymised):

From 2021 to 2024, Bakkerij Example had a webshop at winkel.example.com, with a CNAME record pointing to bakkerij-example.webwinkelplatform.example, and in 2024 the bakery switched platforms and cancelled the subscription. The CNAME record was left in place. A year later, someone else created a shop on the same platform under the now available name bakkerij-example. From that moment on, winkel.example.com showed a fake shop, with a valid certificate and under the bakery's name.

A dangling record (dangling DNS) is a DNS record that points to something you no longer control: a cancelled service, a deleted cloud server, an IP address that has since been issued to someone else. If someone else can claim that target, it's called subdomain takeover. The attacker gets a subdomain of yours, and can use it to host phishing pages that look completely genuine, sometimes even reading cookies from your main domain.

Protection:

1. Cancelling = remove the DNS record first, then cancel the service. Put this in your offboarding procedure for services.
2. Go through your entire DNS zone once a year. If you don't know what a record is for, find out. Make a backup of the zone before you remove anything.
3. Be extra careful with wildcards (*.example.com) that point to an external service.

DNSSEC and CAA: extra locks

DNSSEC puts a digital signature on your DNS answers, so a resolver can check that they're genuine and haven't been tampered with along the way. For .nl it's switched on by default with many providers. It protects against forged DNS answers, not against a hijacked registrar account. A plain-language explanation is in lesson 8.1 of the DNS course.

CAA is a DNS record in which you specify which certificate authorities are allowed to issue a certificate for your domain (RFC 8659). Without CAA, any trusted issuer may do so. With CAA, you make it harder for an attacker to get a certificate for your name elsewhere. If you set CAA, do include the issuer your hosting provider uses, otherwise your own certificate can no longer be renewed. More in lesson 5.2 of the DNS course.

In practice: what it looks like

You can see your domain's status and expiry in the public registration data (RDAP, the successor to whois). A .com domain, for example, shows:

Status:     client delete prohibited, client transfer prohibited, client update prohibited
Registration: 2019-03-01
Expires:    2027-03-01
DNSSEC:     yes

Not every registry shows an expiry date: SIDN doesn't show one for .nl in RDAP. In that case, check with your registrar. At WebOké, expiry, automatic renewal, quarantine, DNSSEC and CAA are all shown together on the Domain / Email health card on the domain page in My WebOké, and the DNS settings have a button to make a backup of your zone. Other providers work in a similar way.

Summary

• Whoever manages your domain receives your mail and can use it to reset your password anywhere.
• Keep the registrant details correct, use a registrant address outside the domain itself, and turn on automatic renewal.
• Protect your registrar account with 2FA and individual accounts; treat the transfer code as a key; a registrar lock blocks unwanted transfers.
• When cancelling a service, remove the DNS record first; go through your zone every year to check for dangling records.
• DNSSEC protects against forged DNS answers, CAA limits who may issue certificates for your domain.

Quiz

Exercise

Exercise A4.3: Checking the protection of your domain. Enter your own domain name (if you don't have one, use sidn.nl). The program retrieves the status and expiry date from the registry (RDAP) and checks DNSSEC and CAA. You'll get a green, orange or red result for each point, or an informational message.

Exercise D4.3: Domain list and zone check. Make a list of all your domains with registrar, registrant, expiry and who has access. Then go through the DNS zone of your main domain and find out what each record is for.

Further reading

The steps in the WebOké articles apply to the WebOké environment; other providers work in a similar way.

• Emails from ICANN or the registry about your domain: real or fake, and what should you do?
• WebOké manual 5.17: Domain and email health: checking and fixing
• Making and restoring a backup of your DNS
• Public domain health: https://www.weboke.pl/en/domain-health
• DNS course, lessons 1.3 (registry, registrar and registrant), 5.2 (CAA) and 8.1 (DNSSEC): https://www.weboke.pl/en/dns-cursus
• ICANN, EPP status codes explained: https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en
• SIDN, cancelling your domain name and quarantine: https://www.sidn.nl/en/nl-domain-name/cancelling-your-domain-name
• MDN, subdomain takeovers: https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers